Skip to main content

Monitoring Hyper-V

A Hyper-V host is recognised by its management service, and every virtual machine on it is reported within a minute: state, vCPUs, memory, uptime, plus the Hyper-V administrative event channels as logs. The agent queries WMI directly, with no PowerShell involved, and runs as a normal Windows service. Install it on the host itself as described in Windows installation.

How Hyper-V is recognised​

The signed Hyper-V definition matches a Windows host where the vmms service (Hyper-V Virtual Machine Management) is registered. Every minute the compiled probe queries the root\virtualization\v2 WMI namespace with a 15-second budget: the Msvm_ComputerSystem class for the machines with the caption "Virtual Machine", plus the processor and memory setting classes to attach vCPU and memory figures to each VM by its identifier. The definition is Windows-only; on any other platform the probe reports that plainly.

What is collected​

Guests. Every VM becomes a guest in the host inventory with its state (running, off, saved, paused, or other), its vCPU count and its configured memory. Per VM the probe reports whether it is running, the vCPUs, the memory in bytes and, for running machines, the uptime. Two totals give the number of defined and running VMs.

SignalMetric
VMs defined / runningsvc.hyperv.domains, svc.hyperv.running
Per-VM statesvc.hyperv.guest.running tagged by vm
Per-VM vCPUs and memorysvc.hyperv.guest.vcpus, svc.hyperv.guest.mem_bytes
Per-VM uptimesvc.hyperv.guest.uptime_sec

Names, tags and units are in the metrics reference.

Logs. The logs-hyperv definition reads two Event Log channels, Microsoft-Windows-Hyper-V-VMMS-Admin and Microsoft-Windows-Hyper-V-Worker-Admin, and ships their entries at notice level and above by default, which means errors and warnings. See Logs.

Alerts out of the box​

RuleFires whenSeverityShips
Hyper-V guest is not runninga VM is not in the running state for 5 minuteswarningoff

The rule ships off because a VM that is off, saved or paused is normal on most hosts: templates, standbys, test machines someone shut down for the night. Enable it per workspace where every defined VM is supposed to be up; it then opens one incident per VM and closes when the machine runs again. Everything else on this page can drive a custom rule in the console (/alerting/rules). Thresholds and hysteresis are in the rules catalog.

Limitations​

  • Memory is the configured amount from the VM's settings, not what the guest currently uses.
  • Per-VM CPU usage, disk IO and network throughput are not collected; the probe reports state, sizing and uptime.
  • The agent has to run on the Hyper-V host itself. A VM cannot report on its neighbours, and the WMI namespace is local.
  • Checkpoints, replicas and virtual switches are not read.
  • VMs are identified by their display name. Two VMs that share a name share one series and one inventory entry.